Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

file.exe

windows7-x64

10

file.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    file.exe

  • Size

    685KB

  • Sample

    221018-tqsaksgdf6

  • MD5

    f46ec173d8bde278bd30b1ea98139b82

  • SHA1

    449d0804551bddab7e74b5f49075844c7eb5910b

  • SHA256

    01e7e40df68d964bc66f0b36b986abe39b395baedf8f2067378c395bedffd59e

  • SHA512

    721f2ce3d13a44d2a5a601fdb4448acb710397295e5f4992ba53a268072d36fba19e1758ed7d9e59e77ea71de353b3e0460cde7fb931d75439dd5926513b8bf3

  • SSDEEP

    12288:6Nqf31kcqzecjnf6vBSx7zr/5Ot3blrAJR1pvXvamrbfWQM27W5stq:n1qzeEiSbBwblrAbtnfsst

Score
10/10
dcratinfostealerrat

Malware Config

Targets

    • Target

      file.exe

    • Size

      685KB

    • MD5

      f46ec173d8bde278bd30b1ea98139b82

    • SHA1

      449d0804551bddab7e74b5f49075844c7eb5910b

    • SHA256

      01e7e40df68d964bc66f0b36b986abe39b395baedf8f2067378c395bedffd59e

    • SHA512

      721f2ce3d13a44d2a5a601fdb4448acb710397295e5f4992ba53a268072d36fba19e1758ed7d9e59e77ea71de353b3e0460cde7fb931d75439dd5926513b8bf3

    • SSDEEP

      12288:6Nqf31kcqzecjnf6vBSx7zr/5Ot3blrAJR1pvXvamrbfWQM27W5stq:n1qzeEiSbBwblrAbtnfsst

    Score
    10/10
    dcratinfostealerrat

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks